Skip to content
OpenAdvisories

Archive

1 August 2019

Vulnerabilities first published on this day (UTC), newest first.

← July 2019 2019 / August /1 September 2019 →
  1. 1162
  2. 2182
  3. 32
  4. 4 
  5. 560
  6. 664
  7. 776
  8. 859
  9. 954
  10. 104
  11. 113
  12. 1247
  13. 1368
  14. 14176
  15. 1556
  16. 1645
  17. 175
  18. 1817
  19. 1942
  20. 20197
  21. 21115
  22. 22111
  23. 2377
  24. 24 
  25. 252
  26. 26121
  27. 2762
  28. 2870
  29. 2997
  30. 3033
  31. 31 
All Critical High Medium Low Exploited only Public exploit

162 results · Feed

  • Unscored —
    CVE-2019-14471

    TestLink 1.9.19 has XSS via the error.php message parameter.

  • Unscored —
    CVE-2018-20900

    cPanel before 71.9980.37 allows stored XSS in the YUM autorepair functionality (SEC-399).

  • Unscored —
    CVE-2018-20899

    cPanel before 71.9980.37 allows stored XSS in the WHM cPAddons installation interface (SEC-398).

  • Unscored —
    CVE-2018-20898

    cPanel before 71.9980.37 allows e-mail injection during cPAddons moderation (SEC-396).

  • Unscored —
    CVE-2018-20897

    cPanel before 71.9980.37 allows arbitrary file-unlink operations via the cPAddons moderation system (SEC-395).

  • Unscored —
    CVE-2018-20896

    cPanel before 71.9980.37 allows code injection in the WHM cPAddons interface (SEC-394).

  • High 7.2
    CVE-2019-0193 Exploited Public exploit Scanner template EPSS 84%

    XML External Entity (XXE) Injection in Apache Solr

    In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in which the whole DIH configuration can come from a request's "dataConfig" parameter. The debug mode of the DIH admin screen…

    Apache Apache Solr org.apache.solr:solr-core lucene-solr Debian Ubuntu Maven
    KEV Dec 10, 2021
  • Unscored —
    CVE-2018-20895

    In cPanel before 71.9980.37, API tokens retain ACLs after those ACLs are removed from the corresponding accounts (SEC-3…

  • High 7.4
    CVE-2014-8183

    It was found that foreman, versions 1.x.x before 1.15.6, in Satellite 6 did not properly enforce access controls on cer…

    The Foreman Project foreman
  • High 8.1
    CVE-2018-10899

    Cross-Site Request Forgery in Jolokia

    A flaw was found in Jolokia versions from 1.2 to before 1.6.1. Affected versions are vulnerable to a system-wide CSRF. This holds true for properly configured instances with strict checking for origin and referrer headers. This could result in a Remote Code E…

    jolokia jolokia org.jolokia:jolokia-core Maven
  • High 8.1
    CVE-2019-3890

    It was discovered evolution-ews before 3.31.3 does not check the validity of SSL certificates. An attacker could abuse …

    The Gnome Project evolution-ews evolution-ews evolution-ews Debian Ubuntu
  • Low 3.6
    CVE-2019-3884

    A vulnerability exists in the garbage collection mechanism of atomic-openshift. An attacker able spoof the UUID of a va…

    Red Hat atomic-openshift
  • Unscored —
    CVE-2018-20894

    cPanel before 74.0.0 makes web-site contents accessible to other local users via Git repositories (SEC-443).

  • Unscored —
    CVE-2018-20893

    cPanel before 74.0.0 allows file-rename operations during account renames (SEC-442).

  • Unscored —
    CVE-2018-20892

    cPanel before 74.0.0 allows arbitrary zone file modifications because of incorrect CAA record handling (SEC-439).

  • Unscored —
    CVE-2018-20891

    cPanel before 74.0.0 allows arbitrary file-read operations during File Restoration (SEC-436).

  • Unscored —
    CVE-2018-20890

    cPanel before 74.0.0 allows arbitrary zone file modifications during record edits (SEC-426).

  • Unscored —
    CVE-2018-20889

    cPanel before 74.0.0 allows certain file-read operations via password file caching (SEC-425).

  • Unscored —
    CVE-2018-20888

    cPanel before 74.0.0 allows file modification in the context of the root account because of incorrect HTTP authenticati…

  • Unscored —
    CVE-2018-20887

    cPanel before 74.0.0 allows SQL injection during database backups (SEC-420).

  • Unscored —
    CVE-2018-20886

    cPanel before 74.0.0 insecurely stores phpMyAdmin session files (SEC-418).

  • Unscored —
    CVE-2018-20885

    cPanel before 74.0.0 allows Apache HTTP Server configuration injection because of DocumentRoot variable interpolation (…

  • Unscored —
    CVE-2018-20884

    cPanel before 74.0.0 allows stored XSS in the WHM File Restoration interface (SEC-367).

  • Unscored —
    CVE-2019-14468

    GnuCOBOL 2.2 has a buffer overflow in cb_push_op in cobc/field.c via crafted COBOL source code.

    gnucobol gnucobol Debian Ubuntu
  • Unscored —
    CVE-2018-20883

    cPanel before 74.0.8 allows FTP access during account suspension (SEC-449).

  • Unscored —
    CVE-2018-20882

    cPanel before 74.0.8 allows arbitrary file-write operations in the context of the root account during WHM Force Passwor…

  • Unscored —
    CVE-2018-20881

    cPanel before 74.0.8 allows self stored XSS on the Security Questions login page (SEC-446).

  • Unscored —
    CVE-2018-20880

    cPanel before 74.0.8 mishandles account suspension because of an invalid email_accounts.json file (SEC-445).

  • Unscored —
    CVE-2018-20879

    cPanel before 74.0.8 allows demo accounts to execute arbitrary code via the Fileman::viewfile API (SEC-444).

  • Unscored —
    CVE-2018-20878

    cPanel before 74.0.8 allows stored XSS in WHM "File and Directory Restoration" interface (SEC-441).

  • Unscored —
    CVE-2018-20877

    cPanel before 74.0.8 allows self XSS in WHM Style Upload interface (SEC-437).

  • Unscored —
    CVE-2018-20876

    cPanel before 74.0.8 allows self XSS in the Site Software Moderation interface (SEC-434).

  • Unscored —
    CVE-2018-20875

    cPanel before 74.0.8 allows self XSS in the WHM Security Questions interface (SEC-433).

  • Unscored —
    CVE-2018-20874

    cPanel before 74.0.8 allows self XSS in the WHM "Create a New Account" interface (SEC-428).

  • Unscored —
    CVE-2018-20873

    cPanel before 74.0.8 allows local users to disable the ClamAV daemon (SEC-409).

  • Unscored —
    CVE-2019-14338

    An issue was discovered on D-Link 6600-AP and DWL-3600AP Ax 4.2.0.14 21/03/2019 devices. There is a post-authentication…

  • Unscored —
    CVE-2019-14337

    An issue was discovered on D-Link 6600-AP and DWL-3600AP Ax 4.2.0.14 21/03/2019 devices. There is an ability to escape …

  • Unscored —
    CVE-2019-14336

    An issue was discovered on D-Link 6600-AP and DWL-3600AP Ax 4.2.0.14 21/03/2019 devices. There is post-authenticated du…

  • Unscored —
    CVE-2019-14334

    An issue was discovered on D-Link 6600-AP, DWL-3600AP, and DWL-8610AP Ax 4.2.0.14 21/03/2019 devices. There is post-aut…

  • Unscored —
    CVE-2019-14333

    An issue was discovered on D-Link 6600-AP and DWL-3600AP Ax 4.2.0.14 21/03/2019 devices. There is a pre-authenticated d…